Changeset 1913

Timestamp:

01/26/11 22:01:22 (2 years ago)

Author:

ahu

Message:

finish up support for GOST, including DS with digest type=3, plus abstract out relevant hashes to the signer objects.
Plus update the formatting of the Russian anthem in botan19signers.cc ;-)

Location:

trunk/pdns/pdns

Files:

• botan19signers.cc (modified) (6 diffs)
• dnssecinfra.cc (modified) (3 diffs)
• dnssecinfra.hh (modified) (1 diff)
• pdnssec.cc (modified) (1 diff)
• polarrsakeyinfra.cc (modified) (7 diffs)

trunk/pdns/pdns/botan19signers.cc

@@ +1 @@
+// utf-8 UTF-8 utf8 UTF8
 #include <botan/botan.h>
 #include <botan/ecdsa.h>
 #include <botan/gost_3410.h>
+#include <botan/gost_3411.h>
+#include <botan/sha2_32.h>
+#include <botan/sha2_64.h>
 #include <botan/pubkey.h>
 #include <botan/look_pk.h>
@@ -12 +16 @@
     "The National Anthem of the Russian Federation"
     
- ~      Rossiya - svyashchennaya nasha derzhava,  ~
+ ~  Rossiya - svyashchennaya nasha derzhava,  ~
  ~  Rossiya - lyubimaya nasha strana.         ~
  ~  Moguchaya volya, velikaya slava -         ~
@@ -25 +29 @@
   std::string getPubKeyHash() const;
   std::string sign(const std::string& hash) const; 
+  std::string hash(const std::string& hash) const; 
   bool verify(const std::string& hash, const std::string& signature) const;
   std::string getPublicKeyString() const;
@@ -184 +189 @@
 }
 
+std::string GOSTDNSPrivateKey::hash(const std::string& orig) const
+{
+  SecureVector<byte> result;
+  
+  GOST_34_11 hasher;
+  result= hasher.process(orig);
+  
+  return string((const char*)result.begin(), (const char*) result.end());
+}
+
 bool GOSTDNSPrivateKey::verify(const std::string& hash, const std::string& signature) const
 {
@@ -207 +222 @@
   std::string getPubKeyHash() const;
   std::string sign(const std::string& hash) const; 
+  std::string hash(const std::string& hash) const; 
   bool verify(const std::string& hash, const std::string& signature) const;
   std::string getPublicKeyString() const;
@@ -344 +360 @@
 }
 
+std::string ECDSADNSPrivateKey::hash(const std::string& orig) const
+{
+  SecureVector<byte> result;
+  if(getBits() == 256) { // SHA256
+    SHA_256 hasher;
+    result= hasher.process(orig);
+  }
+  else { // SHA384
+    SHA_384 hasher;
+    result = hasher.process(orig);
+  }
+  
+  return string((const char*)result.begin(), (const char*) result.end());
+}
+
+
 bool ECDSADNSPrivateKey::verify(const std::string& hash, const std::string& signature) const
 {

trunk/pdns/pdns/dnssecinfra.cc

@@ -10 +10 @@
 #include "dnssecinfra.hh" 
 #include "dnsseckeeper.hh"
-
-#include <polarssl/sha1.h>
-#include <polarssl/sha2.h>
-#include <polarssl/sha4.h>
+#include "polarssl/sha1.h"
 #include <boost/assign/std/vector.hpp> // for 'operator+=()'
 #include <boost/assign/list_inserter.hpp>
@@ -122 +119 @@
   }
   
-  // algorithm 12 needs special GOST hash
-  
-  if(rrc.d_algorithm <= 7 ) {  // RSASHA1
-    unsigned char hash[20];
-    sha1((unsigned char*)toHash.c_str(), toHash.length(), hash);
-    return string((char*)hash, sizeof(hash));
-  } else if(rrc.d_algorithm == 8 || rrc.d_algorithm == 13) { // RSASHA256 or ECDSAP256
-    unsigned char hash[32];
-    sha2((unsigned char*)toHash.c_str(), toHash.length(), hash, 0);
-    return string((char*)hash, sizeof(hash));
-  } else if(rrc.d_algorithm == 10) { // RSASHA512
-    unsigned char hash[64];
-    sha4((unsigned char*)toHash.c_str(), toHash.length(), hash, 0);
-    return string((char*)hash, sizeof(hash));
-  } else if(rrc.d_algorithm == 14) { // ECDSAP384
-    unsigned char hash[48];
-    sha4((unsigned char*)toHash.c_str(), toHash.length(), hash, 1); // == 384
-    return string((char*)hash, sizeof(hash));
-  }
-  else {
-    cerr<<"No idea how to hash for algorithm "<<(int)rrc.d_algorithm<<endl;
-    exit(1);
-  }
+  shared_ptr<DNSPrivateKey> dpk(DNSPrivateKey::make(rrc.d_algorithm));
+  return dpk->hash(toHash);
 }
 
@@ -153 +129 @@
   toHash.append(const_cast<DNSKEYRecordContent&>(drc).serialize("", true, true));
 
-  unsigned char hash[32];
-  if(digest==1)
-    sha1((unsigned char*)toHash.c_str(), toHash.length(), hash);
-  else
-    sha2((unsigned char*)toHash.c_str(), toHash.length(), hash, 0);
-
+  
   DSRecordContent dsrc;
+  if(digest==1) {
+    shared_ptr<DNSPrivateKey> dpk(DNSPrivateKey::make(5)); // gives us SHA1
+    dsrc.d_digest = dpk->hash(toHash);
+  }
+  else if(digest == 2) {
+    shared_ptr<DNSPrivateKey> dpk(DNSPrivateKey::make(8)); // gives us SHA256
+    dsrc.d_digest = dpk->hash(toHash);
+  }
+  else if(digest == 3) {
+    shared_ptr<DNSPrivateKey> dpk(DNSPrivateKey::make(12)); // gives us GOST
+    dsrc.d_digest = dpk->hash(toHash);
+  }
+  
   dsrc.d_algorithm= drc.d_algorithm;
   dsrc.d_digesttype=digest;
   dsrc.d_tag=const_cast<DNSKEYRecordContent&>(drc).getTag();
-  dsrc.d_digest.assign((const char*)hash, digest == 1 ? 20 : 32);
   return dsrc;
 }

trunk/pdns/pdns/dnssecinfra.hh

@@ -15 +15 @@
     virtual std::string getPubKeyHash()const =0;
     virtual std::string sign(const std::string& hash) const =0;
+    virtual std::string hash(const std::string& hash) const =0;
     virtual std::string getPublicKeyString()const =0;
     virtual int getBits() const =0;

trunk/pdns/pdns/pdnssec.cc

@@ -207 +207 @@
         cout<<"KSK DNSKEY = "<<zone<<" IN DNSKEY "<< value.first.getDNSKEY().getZoneRepresentation() << endl;
         cout<<"DS = "<<zone<<" IN DS "<<makeDSFromDNSKey(zone, value.first.getDNSKEY(), 1).getZoneRepresentation() << endl;
-        cout<<"DS = "<<zone<<" IN DS "<<makeDSFromDNSKey(zone, value.first.getDNSKEY(), 2).getZoneRepresentation() << endl << endl;
+        cout<<"DS = "<<zone<<" IN DS "<<makeDSFromDNSKey(zone, value.first.getDNSKEY(), 2).getZoneRepresentation() << endl;
+        cout<<"DS = "<<zone<<" IN DS "<<makeDSFromDNSKey(zone, value.first.getDNSKEY(), 3).getZoneRepresentation() << endl << endl;
       }
     }

trunk/pdns/pdns/polarrsakeyinfra.cc

@@ -3 +3 @@
 #include <polarssl/sha1.h>
 #include <polarssl/sha2.h>
+#include <polarssl/sha4.h>
 #include <polarssl/havege.h>
 #include <boost/assign/std/vector.hpp> // for 'operator+=()'
@@ -16 +17 @@
 {
 public:
-  RSADNSPrivateKey()
+  explicit RSADNSPrivateKey(unsigned int algorithm) : d_algorithm(algorithm)
   {
     memset(&d_context, 0, sizeof(d_context));
@@ -37 +38 @@
   RSADNSPrivateKey(const RSADNSPrivateKey& orig) 
   {
+    d_algorithm = orig.d_algorithm;
+    
     d_context.ver = orig.d_context.ver;
     d_context.len = orig.d_context.len;
@@ -51 +54 @@
   RSADNSPrivateKey& operator=(const RSADNSPrivateKey& orig) 
   {
+    d_algorithm = orig.d_algorithm;
+    
     d_context.ver = orig.d_context.ver;
     d_context.len = orig.d_context.len;
@@ -81 +86 @@
   std::string getPubKeyHash() const;
   std::string sign(const std::string& hash) const; 
+  std::string hash(const std::string& hash) const; 
   std::string getPublicKeyString() const;
   int getBits() const
@@ -89 +95 @@
   void fromPEMString(DNSKEYRecordContent& drc, const std::string& raw);
 
-  static DNSPrivateKey* maker(unsigned int)
-  {
-    return new RSADNSPrivateKey();
+  static DNSPrivateKey* maker(unsigned int algorithm)
+  {
+    return new RSADNSPrivateKey(algorithm);
   }
 
 private:
   rsa_context d_context;
+  unsigned int d_algorithm;
 };
 
@@ -159 +166 @@
   return string((char*) signature, sizeof(signature));
 }
+
+std::string RSADNSPrivateKey::hash(const std::string& toHash) const
+{
+  if(d_algorithm <= 7 ) {  // RSASHA1
+    unsigned char hash[20];
+    sha1((unsigned char*)toHash.c_str(), toHash.length(), hash);
+    return string((char*)hash, sizeof(hash));
+  } 
+  else if(d_algorithm == 8) { // RSASHA256
+    unsigned char hash[32];
+    sha2((unsigned char*)toHash.c_str(), toHash.length(), hash, 0);
+    return string((char*)hash, sizeof(hash));
+  } 
+  else if(d_algorithm == 10) { // RSASHA512
+    unsigned char hash[64];
+    sha4((unsigned char*)toHash.c_str(), toHash.length(), hash, 0);
+    return string((char*)hash, sizeof(hash));
+  }
+  throw runtime_error("PolarSSL hashing method can't hash algorithm "+lexical_cast<string>(d_algorithm));
+}
+
 
 std::string RSADNSPrivateKey::convertToISC(unsigned int algorithm) const